Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-85247Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
- CVE-2026-85246Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-85245Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target
- CVE-2026-85243Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure
- CVE-2026-84181Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse
- CVE-2026-84180Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-84178Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow
- CVE-2026-84176Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
- CVE-2026-83531Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages
- CVE-2026-80344Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address
- CVE-2026-80343Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching
- CVE-2026-80312Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
- CVE-2026-79986Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without…
- CVE-2026-79985Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
- CVE-2026-79984Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
- CVE-2026-79983Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without…
- CVE-2026-78165Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
- CVE-2026-78164Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
- CVE-2026-78163Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
- CVE-2026-78162Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
- CVE-2026-90910Apache Answer: Reaction API authorization bypass for restricted content
- CVE-2026-86589Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
- CVE-2026-79633Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
- CVE-2026-79624Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
- CVE-2026-79620Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
- CVE-2026-79613Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
- CVE-2026-76994Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
- CVE-2026-71563Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
- CVE-2026-68482Apache Answer: Improper Authorization in Question Invite User Lookup
- CVE-2026-67249Apache Answer: Email Code Purpose Confusion May Allow Account Takeover